T09 · Insecure Skill Coding Practices
Error
- Location
scripts/validate_mew_design_key.py:19- Finding
API key can be transmitted to an arbitrary caller-controlled server
- Content
View full analysis
argparse.Namespace: parser = argparse.ArgumentParser( description="Validate a mew.design API key using an auth-only probe request.", ) parser.add_argument("--api-key", required=True, help="mew.design API key to validate.") parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="Gateway base URL.") parser.add_argument("--timeout", type=int, default=30, help="Request timeout in seconds.") return parser.parse_args() def build_endpoint(base_url: str) -> str: normalized = base_url.rstrip("/") + "/" return urllib.parse.urljoin(normalized, "open/api/design/generate") def probe_key(endpoint: str, api_key: str, timeout: int) -> dict: request = urllib.request.Request( endpoint, data=b"{}", headers={ "Content-Type": "application/json", "x-api-key": api_key, "User-Agent": "curl/8.7.1", "Accept": "*/*", }, ``` ### Technical Analysis The validator accepts an unrestricted `--base-url`, constructs an endpoint from it, and sends the user-provided Mew API key in the `x-api-key` request header. It does not enforce HTTPS, validate the destination hostname, or restrict the endpoint to the declared Mew service at `api.mew.design`. Sending the credential to Mew is necessary for the advertised key-validation functionality. Allowing callers or agent instructions to redirect that credential to any server exceeds the minimum privileges required for the Skill. An attacker who can influence the command invocation can set `--base-url` to an attacker-controlled HTTP or HTTPS service. The validator will then deliver the API key to that service. The same credential-forwarding risk may arise if t ...[truncated 1289 chars]- Remediation
View remediation